General Topics

Mac Mail, GMail and vulnerability CVE-2004-2501

On a PA 2020 running 4.03, the threat log is filled with clients triggering alerts for MailEnable IMAP Server Long Tag anomaly (CVE-2004-2501), rated "high".They are all in fact Mac Mail clients trying to talk IMAP to GMail servers on port 993. On the face of it they must all be false positives. SSL decryption is being used. Could anyone give an...

Why IPS throughput is 1/2 than firewall throughput?

I'm looking for explanation about why some appliances has IPS throughput that is a half than firewall throughput (for instance 4050), and why 4020 has 2 Gb of throuhput in both fields. As I understand this is not that Palo Alto with IPS feature activate has half throughput than another without threat prevention but I have not the exact explanati...

How to authenticate users on Unix systems without Captive Portal

I have a set of users that have command line access to certain systems, they need to go out through the PAs. How do I authenticate the users if they have no access to a browser and cannot use the Captive Portal feature?Thanks!Dave

Monitor interfaces/subinterfaces with SNMP

Is there a timeline when this feature request will be available? This can very be helpful for many of us with tools like cacti or other similar RRD tools to monitor bandwidth usage across a particular interface.

VPN Client problems on Windows 7 64 bit

Hi,I'm experimenting problems with the vpn client, it doesn't works on windows 7 64 bit, both with Windows 7 SP1 and Windows 7 not SP1. Someone has experimented this issue?Regards.

threat prevention throughput with aggregate interfaces

Currently we have a 1 gig pipe to the internet, we will be upgrading our internet pipe to 10 gig capability in the next month. We will be aggregating several interfaces to accommodate the additional bandwidth requirements. Basically going from a 1 gig interface to port-channelling to a 2-gig interface. If we turn on Threat Prevention on this ...

Panorama Utilization Spikes

Hello,Is there a scheduled process that runs every 15 minutes on Pano? CPU and memory spike at same timeframe every 15 minutes. The CPU spike is quick - while the memory spike jumps - and then takes some time to release the memory usage. Running 4.0.3. Did not notice this during the 3.x code - and only just noticed the other day (been on 4.x ...

How to shutdown a PA-4020

We need to shutdown a PA-4020 on 3.1.5 for relocation. "request restart system" no longer works. Does anyone know the new command line command? Thanks

Effectivenes of DOS protection

Hi, will appreciate the comments of the PAN community about the efectivenes of the DOS protection features of Palo Alto. Are there DOS attacks that can't be mitigated by Palo Alto ?ThksMario

Resolved! Packet flow question

Hi everybody,Device: PA-500Software: 3.1.7we have a problem with our vpn tunnels. The tunnels are up and running,but when I try to connect or ping a system over the tunnel we are getting timeouts.To figure out what happens, I did a packet flow all and a packet capture and here I get an entry which I can not explain."L2 broadcast cannot be forwar...

Resolved! VPN Password Length

Hello All,I noticed that there is a password length limitation when using the VPN page. Can this be increased to something like 40 characters to support longer OTP characters?Thanks,Will

Resolved! NetConnect Certificates

I'm looking for a bit of info on how the NetConnect client uses certificates.I have a VPN endpoint configured on my PAN firewall which is configured to use a GoDaddy Wildcard SSL certificate. When I connect to the web portal the installed certificate is valid and recognised by the browser.When a user authenticates and the NetConnect client start...

Firewall fails with "APT-HTTP/1.3" in useragent string, like ubuntu do during update

user@unix:~/kannweg> wget -d -U"nonsense APT-HTTP/1.3" www.dackel.defails allways with2011-06-16 13:44:16 FEHLER 503: Service Unavailable.user@unix:~/kannweg> wget -d -U"nonsense APT-HTTP1.3" www.dackel.deworks.There is no log entry of this in any firewall log.Seems to be an intolerance of the Palo Alto firewall to "APT-HTTP/1.3".

Resolved! no-pbf action rule not matching traffic

Hello,After creating some PBF rules, I'm checking out if there's some traffic matching or not. I realize that PBF regular rules, are SHOWING matches. But the PBF with no-pbf action rules are not showing matches. I believe that the action is working but the counter is not working properly. Do you know the expected behavior?By the other hand, If t...

Captive portal for user authenticated

Hi,We have a client with Active directory domain, this client have a lot of user with the same username (generic) in domain. Actually, when a user wants to access to Internet, the proxy IAS ask the user another user/pass and then if the user have access to internet put another user/pass. Is it possible with PaloAlto? I see that the source, in ca...

Discussions